No value set for dynamic attribute 'needs_initial_od_sync'

Hi all,

After years of running and a couple of version upgrades, my 10.9.5, Server 3.3.2 Profile Manager has fallen over, and it can't get up. It appears that clients can still talk to it, but the web interface is broken, with queries to <server>/profilemanager redirecting to auth?redirect=https:<server>/devicemanagement/webapi/authentication/callback

Enabling verbose logging in profile manager and requesting the <server>/profilemanager url leads to this being logged in /Library/Logs/ProfileManager/profilemanager.log:

[73795] [2015/10/09 12:34:23.588] I: Processing MagicController#admin_will_load (for 192.168.6.14 at 2015-10-09 12:34:23) [POST]
[73795] [2015/10/09 12:34:23.593] E: No value set for dynamic attribute 'needs_initial_od_sync' [73795] [2015/10/09 12:34:23.594] I: auth_token doesn't exist
[73795] [2015/10/09 12:34:23.594] I: Filter chain halted as [:verify_auth_token] rendered_or_redirected.
[73795] [2015/10/09 12:34:23.595] I: Completed in 6ms (View: 1, DB: 5) | 403 Forbidden [https://<server>/magic/admin_will_load]

[73796] [2015/10/09 12:34:26.060] I: Processing MagicController#do_magic (for 192.168.6.14 at 2015-10-09 12:34:26) [POST]

The initial OD sync would have been done long ago but somehow... it forgot? What are the possible values for 'needs_initial_od_sync', and how would one set them?